Last updated: 05/20/2025.

‍

• PREAMBULE

NABLA Technologies SAS (“NABLA”) is a simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register under number 838 878 155, having its registered office at 22 rue Chapon, 75003 Paris, France.

‍

NABLA has developed a software solution incorporating artificial intelligence features, specifically dedicated to the automated generation of medical reports (the “Solution”). The Solution is accessible as a web extension or an application, and its specifications are detailed in the technical documentation provided by NABLA.

‍

Under the agreement concluded between NABLA and the CLIENT (the “Contract”), the Solution is made available:

• Either directly for the benefit of a healthcare professional, who is the end user of the Solution;
• Or through a partner, who integrates the Solution into a broader offering intended for healthcare professionals.

‍

Accordingly, NABLA may process personal data, including health-related data, on behalf of the CLIENT under the following conditions:

• As a data processor, when the CLIENT is a healthcare professional acting as the data controller;
• As a sub-processor (or second-tier processor), when the CLIENT acts on behalf of a data controller in the capacity of a primary processor.

‍

In both cases, NABLA acts as a processor within the meaning of Article 4.8 of the GDPR and undertakes to comply with all obligations arising therefrom, whether acting as a direct or second-tier processor.

‍

This data processing agreement (the “Agreement”) is intended to define the terms under which NABLA agrees to carry out personal data processing operations in the context of executing the Contract and applies between the Parties to ensure compliance with Article 28 of the GDPR.

‍

The processing operations covered by this Agreement are described in Appendix 2. In the event of any changes to such Processing during the term of the Contract, the Parties agree to update Appendix 2, which shall constitute an amendment to both this Agreement and the Contract.

‍

The Parties also agree to process any personal data collected, exchanged, produced, managed, or hosted under the Contract in accordance with applicable data protection laws and the provisions of this Agreement.

‍

Finally, the Parties declare that:

• They are aware of the obligations arising from the applicable data protection legislation;
• They possess the necessary expertise and sufficient financial resources to implement and comply with all obligations arising from the data protection laws for all services performed under the Contract.

‍

• DEFINITIONS

The terms reproduced below shall be understood within these provisions as defined in Article 4 of the GDPR:

‍

"Agreement"

:

this Data Protection Agreement, as set forth in the header hereof, together with any annexes and riders thereto;

"Controlling Authority".

The competent control authority in France is the Commission Nationale de l'Informatique et des Libertés (CNIL), an independent administrative authority in charge of regulating the use of personal data. It assists professionals in their compliance and helps individuals to control their personal data and exercise their rights;

"Recipient"

The natural or legal person, public authority, service or any other body that receives communication of Personal Data, whether or not it is a Third Party;

"Personal data".

Any information relating to an identified or identifiable natural person (referred to as “data subject”); an identifiable person is an individual who can be identified directly or indirectly, including by reference to an identifier, such as a name, identification number, location data, online identifier, or one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity;

"Health-related Data" or "Health Data”

Personal Data relating to the physical or mental health of a natural person, including the provision of health care services, that reveal information about the individual's health status;

“Purpose of the Processing”

The purposes of the processing activities as defined in Appendix 2 of this Agreement;

“Regulation”

All legal and regulatory provisions applicable in France and the European Union regarding Personal Data protection, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the “GDPR”) and French Law No. 78-17 of 6 January 1978, as amended, in its current and future versions during the term of the Contract (hereinafter the “LIL”);

“Data Controller”

A natural or legal person, public authority, agency, or other body that determines the purposes and means of the processing. Appendix 1 of this Agreement lists the Data Controllers;

“Processor” or “First-Tier Processor”

A natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller. Appendix 1 of this Agreement lists the Processors;

“Second-Tier Processor” or “Subsequent Processor”

A Processor engaged by another Processor to perform specific processing activities on behalf of the Data Controller. Appendix 1 of this Agreement lists the Second-Tier Processors;

“Processing of Personal Data” or “Processing”

Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction, as per Article 4.2 of the GDPR. The processing activities are described in Appendix 1 of this Agreement and, more generally, in the Contract concluded between the Parties.

‍

Terms capitalized and not expressly defined in this Article shall have the meaning assigned to them in the Contract.

‍

1. PURPOSE OF THE AGREEMENT

The provisions of this Agreement shall apply to all processing operations defined in Annex 1 to this Agreement.

‍

The purpose of this Agreement is to define the conditions under which NABLA undertakes to carry out, on behalf of the CLIENT acting either as the DATA CONTROLLER or as a DATA PROCESSOR of the DATA CONTROLLER, the personal Data Processing operations defined in the Contract and in Annex 1 of this Agreement.

‍

This Agreement is drafted in compliance with, among others, the provisions of Articles 28, 32, 33, 34 and 47 of the GDPR.

‍

Within the framework of their contractual relations, the Parties undertake to comply with the Regulation in force applicable to the Processing of Personal Data. In particular, the CLIENT warrants that he has got the consent of the Data Subjects when it is required by the Regulation for the processing of personal health data carried out by the DATA PROCESSOR in the context of the use of the Solution.

‍

The purpose of this Agreement is to define the conditions under which NABLA, acting as a processor or a sub-processor, undertakes to carry out, on behalf of the CLIENT, the processing operations of Personal Data necessary for the performance of the Contract, as detailed in Appendix 2.

‍

This Agreement applies regardless of:

• the CLIENT’s status (whether a healthcare professional or an integration partner);
• NABLA’s contractual position (whether as a processor or sub-processor);
• the access method or deployment mode of the Solution (whether integrated, embedded, or standalone).

‍

2. CONTRACTUAL DOCUMENTS AND ACCEPTANCE PROCEDURES

The contractual relationship between the Parties is governed by the Contract, of which this Agreement forms an integral part.

‍

The invalidity of any provision in one of the aforementioned contractual documents, as determined by a competent court, shall not affect the validity of the remaining documents.

‍

Any waiver of a provision of this Agreement or of any other contractual document between the Parties shall not constitute a definitive waiver of the entirety of the relevant document or of the other contractual documents.

‍

The Parties agree that this Agreement may be updated, particularly in the event of changes to the Processing operations entrusted to NABLA by the CLIENT. Any such update shall be notified or published by any appropriate means and shall become binding on the CLIENT ten (10) days after its notification or publication.

‍

The Parties acknowledge that acceptance of this Agreement by electronic means has, between them, the same probative value as a written agreement signed in hard copy.

3. EFFECTICE DATE AND DURATION

This Agreement shall come into effect as of the date of signature of the Contract and shall remain in force for the duration of the Contract.

‍

Obligations under this Agreement that are based on statutory requirements under the applicable Regulation shall remain in effect beyond the expiration of this Agreement, until the end of the statutory limitation period for any potential liability arising from the Regulation

4. DESCRIPTION OF PROCESSING ACTIVITIES  

NABLA is expressly authorized by the CLIENT to process, on the CLIENT’s behalf, the Personal Data necessary for carrying out the operations specified in the Contract and in Appendix 2 of this Agreement.

‍

To that end, Appendix 2 “Description of Processing Activities” sets out the following:

• The purpose and nature of each Processing activity;
• The objective(s) of each Processing activity;
• The categories of Processing entrusted to NABLA;
• The legal basis ensuring the lawfulness of each Processing activity;
• The categories of Personal Data processed;
• The retention periods of the Personal Data;
• The categories of Data Subjects;
• Information regarding any subsequent sub-processing;
• Information regarding transfers outside the European Union (EU).

‍

When the Processing requires a formal declaration or authorization from a local Supervisory Authority, the CLIENT, representing where applicable the DATA CONTROLLER who retains exclusive responsibility, agrees to provide NABLA with a copy of all such filings, receipts, and authorizations issued by the relevant authority.

‍

5. ROLE OF NABLA

Depending on the method of access to the Solution, NABLA may act:

• As a Processor, where the CLIENT is a healthcare professional directly using the Solution;
• As a Sub-Processor (second-tier Processor), where the CLIENT is a partner integrating the Solution into an offering intended for a healthcare professional who acts as the Data Controller.

‍

6. OBLIGATIONS OF NABLA

NABLA undertakes to:

• Process Personal Data solely for the purposes specified in the Contract;
• Process Personal Data in accordance with the CLIENT’s documented instructions. If NABLA believes that an instruction infringes the Regulation, it shall immediately inform the CLIENT;
• Ensure the confidentiality of Personal Data processed under the Contract;
• Implement appropriate technical and organizational measures to ensure that the Processing complies with the Regulation and protects the rights of the Data Subjects;
• Ensure that persons authorized to process Personal Data under the Contract and this Agreement are bound by confidentiality obligations and have received appropriate data protection training;
• Incorporate data protection principles into the design of its tools, products, applications, and services, and ensure data protection by default.

7. SUBSEQUENT DATA PROCESSING

NABLA may engage Sub-Processors to carry out Personal Data processing operations entrusted by the CLIENT.

‍

In this context, NABLA undertakes to:

• Impose on any Sub-Processors confidentiality and security obligations that are at least equivalent to those provided for in this Agreement;
• Ensure that the Sub-Processor(s) offer the same sufficient guarantees regarding the implementation of appropriate technical and organizational measures to ensure that the Processing complies with the GDPR and applicable regulations. Should the Sub-Processor(s) fail to fulfill their data protection obligations, NABLA shall remain fully liable to the CLIENT for the performance of such obligations by the Sub-Processor(s);
• Notify the CLIENT, by any means, of any addition or replacement of a Sub-Processor. The CLIENT shall have a period of ten (10) calendar days from the date of such notification to raise any objection on legitimate grounds relating to the protection of Personal Data. If the CLIENT raises no objection within this period, the Sub-Processor shall be deemed accepted by the CLIENT, provided that a subcontracting agreement imposing confidentiality and security obligations equivalent to those of this Agreement has been signed before any transfer of Personal Data to the Sub-Processor.

‍

If the CLIENT objects to the designation of a Sub-Processor under the conditions described above, either Party may terminate the Contract with one (1) month’s notice, in accordance with the terms of said Contract. The CLIENT hereby agrees to the use of the Sub-Processors listed in Appendix 1.

8. EXERCISE OF DATA SUBJECT RIGHTS

It is the responsibility of the DATA CONTROLLER to provide Data Subjects with the information required under Articles 12 and following of the GDPR, particularly with respect to Processing activities carried out via the Solution.

‍

To the extent possible, NABLA undertakes to assist the CLIENT in fulfilling its obligations related to the exercise of Data Subjects’ rights (including rights of access, rectification, erasure, restriction of processing, and objection).

‍

In the event of a direct request received from a Data Subject, NABLA commits to forward such request without delay to the CLIENT, using the email address previously provided by the CLIENT.

‍

A procedure for managing Data Subject rights has been agreed between the Parties and is set forth in Appendix 3 of this Agreement.

9. NOTIFICATION OF PERSONAL DATA BREACHES

NABLA shall notify the CLIENT of any Personal Data breach within a maximum period of 48 hours from the time the breach is discovered. The notification shall be sent to the email address provided by the CLIENT and shall include the following information:

• A description of the nature of the Personal Data breach (including, where possible, the categories and the approximate number of Data Subjects affected, and the categories and approximate number of Personal Data records concerned);
• A description of the likely consequences of the Personal Data breach;
• A description of the measures taken or proposed to remedy the Personal Data breach.

‍

This notification shall be accompanied by any documentation necessary to enable the CLIENT, if required, to notify the Supervisory Authority of the breach.

‍

Given the nature of the Processing and the information available to NABLA, NABLA shall also assist the CLIENT in notifying the Personal Data breaches to the affected Data Subjects.

10. ASSISTANCE BY THE PROCESSOR TO THE DATA CONTROLLER

NABLA undertakes to cooperate with the CLIENT to enable it to fulfill its obligations under the Regulation, in particular by:

• Providing the necessary assistance in preparing notifications to the Supervisory Authorities and, where applicable, in communicating with the affected Data Subjects;
• Contributing, at the CLIENT’s request, to the performance of data protection impact assessments, particularly in identifying the existing or planned protective measures for the Processing;
• Assisting the CLIENT, where applicable, in submitting prior authorization requests to the CNIL or the competent Supervisory Authority.

11. SECURITY MEASURES

NABLA undertakes to implement appropriate technical and organizational security measures to ensure the protection of the Processing and the Personal Data.

‍

NABLA further undertakes to:

• Maintain such measures throughout the duration of the Contract and, if unable to do so, to immediately inform the CLIENT;

• In any event, should the implemented security measures be changed, replace them with measures of at least equivalent effectiveness.

‍

Furthermore, the measures implemented by NABLA to ensure Personal Data security include the use of a certified hosting provider, which the CLIENT expressly authorizes. The CLIENT also undertakes to comply with, and ensure that any users comply with, the security requirements defined by the hosting provider, including in particular strong authentication access to the Data.

12. DISPOSAL OF DATA

Upon completion of the services related to the Processing, NABLA undertakes, at the CLIENT’s request and discretion, either to return the Personal Data to the CLIENT in a secure manner or, failing that, to securely delete all Personal Data.

13. REUSE

Due to the significant financial, technical, and human investments made by NABLA in developing and updating the Solution, NABLA wishes to reuse data processed under the Contract in anonymized form for the continuous improvement of the Solution.

‍

To this end, and subject to the prior express authorization of the DATA CONTROLLER, NABLA is authorized to anonymize the data referenced in Appendix 2 of this Agreement, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).

‍

It is expressly agreed that only the DATA CONTROLLER shall determine which reports it wishes to transmit to NABLA for anonymization. Anonymization may only be performed by NABLA following a clear instruction from the DATA CONTROLLER. Once properly anonymized, such reports may be freely reused by NABLA to enhance the Solution.

‍

The CLIENT represents that it has assessed and validated the compatibility of such uses with the applicable Regulation, in light of the initial purposes of the data processing performed under the Contract and in accordance with the terms of this Agreement.

‍

Finally, the CLIENT undertakes to inform the data subjects of the potential anonymization and reuse of their data.

14. RECORD OF PROCESSING ACTIVITIES

NABLA declares that it keeps a written record of all Processing activities carried out on behalf of the CLIENT, in accordance with Article 30.2 of the GDPR.

‍

The CLIENT agrees to provide NABLA with all necessary information required to maintain such record properly.

15. AUDITS AND CONTROLS

NABLA undertakes to make available to the CLIENT all information necessary to demonstrate compliance with the Regulation and with this Agreement, and to allow for and contribute to audits and inspections conducted by the CLIENT or a third-party auditor appointed by the CLIENT.

‍

The CLIENT reserves the right to carry out any verification deemed necessary to assess NABLA’s compliance with its obligations. Any non-compliance with the Regulation and/or this Agreement shall, upon simple notification by the CLIENT, be subject to a corrective action plan to be implemented by NABLA within a maximum of twenty-one (21) days.

‍

NABLA further agrees to promptly inform the CLIENT of any inspection or notification of any kind received from the Supervisory Authority or a Data Subject that directly or indirectly involves the Processing described in this Agreement. NABLA shall follow all instructions given by the CLIENT and cooperate fully with both the Supervisory Authority and the CLIENT.

‍

If the PROCESSOR receives any injunction, request, warrant, or other document requiring or seeking to compel the production of Personal Data (including, for example, oral questions, interrogatories, information requests, subpoenas, civil investigations, regulatory inspections, or similar procedures), it shall immediately inform the CLIENT, unless prohibited by applicable law, and in any event no later than two (2) business days from receipt.

16. CONFIDENTIALITY – TRADE SECRETS - PROFESSIONAL SECRECY

NABLA is bound by the strictest confidentiality obligations, including trade secrets and professional secrecy (collectively referred to as “Secrecy”) concerning the Processing of Personal Data carried out as part of the services.

‍

NABLA undertakes to:

‍

(i) Maintain the confidentiality of all Personal Data for the duration of the Contract and for ten (10) years following its termination, regardless of the cause, provided that NABLA has been entrusted with data retention responsibilities;

‍

(ii) For the entire duration of such data retention, to preserve the confidentiality of all Personal Data and, accordingly:

• Only disclose Personal Data to personnel who need to know it for the execution of this Agreement;
• Take the same measures it applies to its own confidential information to prevent disclosure or publication to third parties.

‍

Generally, NABLA guarantees that it will uphold the strictest confidentiality under the same conditions for any information that comes to its knowledge or that of its personnel.

‍

17. DATA PROTECTION OFFICER

Each Party shall provide the other with the name and contact details of its Data Protection Officer (DPO), if one has been appointed in accordance with Article 37 of the GDPR.

‍

NABLA’s DPO can be contacted at: dpo@nabla.com

18. GOVERNING LAW AND JURISDICTION

This Agreement shall be governed by French law.

‍

IN THE EVENT OF ANY DISPUTE ARISING BETWEEN THE PARTIES CONCERNING THE INTERPRETATION OR PERFORMANCE OF THE CONTRACT, AND FOLLOWING AN ATTEMPT AT AMICABLE SETTLEMENT, EXCLUSIVE JURISDICTION IS EXPRESSLY ASSIGNED TO THE COMMERCIAL COURT OF PARIS, NOTWITHSTANDING MULTIPLE DEFENDANTS OR THIRD-PARTY PROCEEDINGS, INCLUDING FOR SUMMARY OR PROTECTIVE MEASURES, WHETHER IN INTERLOCUTORY OR EX PARTE PROCEEDINGS.

‍

APPENDIX 1 - IDENTIFICATION AND ROLE OF THE PARTIES

‍

This Annex is intended to identify, for each scenario, the role of the parties as defined under the applicable Regulation.

1. NABLA AS A DATA PROCESSOR

Stakeholder

Role

CLIENT (Healthcare Professional – User of the Solution)

Data Controller (determines the purposes and means of processing, including use of the Solution)

NABLA (Solution Provider)

Processor (provides the Solution and performs processing operations on behalf of the healthcare professional)

‍

2. NABLA AS A SUB-PROCESSOR (SECOND-TIER PROCESSOR)

Stakeholder

Role

Healthcare Professional (End User)

Data Controller (determines the purposes and means of processing, including use of the Solution)

CLIENT (NABLA Partner)

Processor (provides the Solution to the healthcare professional)

NABLA (Solution Provider)

Sub-Processor (performs operations on behalf of the CLIENT)

‍

3. NABLA’S SUBSEQUENT SUB-PROCESSORS

In both scenarios described above, NABLA also relies on the following sub-processors:

‍

Company

Product

Purpose / Processing Activities

Google Ireland Ltd

Google Cloud

Hosting of health data as defined under Article L1111-8 of the French Public Health Code (CSP) for all six service layers

Microsoft Ireland Operations Ltd

Speech, GPT-3 and GPT-4

Natural language processing; automatic processing of audio recordings – voice recognition

‍

APPENDIX 2 – DESCRIPTION OF PROCESSING ACTITIVITY(IES)

DESCRIPTION OF PROCESSING ACTIVITY(IES)

• Categories of Data Subjects

‍

The categories of individuals whose Personal Data are subject to Processing include:

• Patients cared for by users of the Solution;
• Users of the Solution, but only when NABLA is acting as a second-tier processor and such data are necessary for the provision of the service.

‍

• Categories of Personal Data Processed

‍

Data relating to patients: 

• Administrative data (e.g., name, first name, date of birth, etc.);
• Health data (e.g., symptoms, medical history, diagnoses, treatments, prescriptions, etc.);
• Personal life data (e.g., lifestyle habits, family situation, etc.);
• More generally, any information the patient may share during a medical examination.

‍

Data relating to users of the Solution (only when the Solution is integrated and provided via a partner):

• Administrative data of the CLIENT’s users;
• Technical data (e.g., login, usage, and geolocation data during use of the Solution).

‍

• Nature of the Processing

‍

The nature of the Processing performed on Personal Data includes collection, access, recording, use, anonymization (where applicable), structuring, hosting, and destruction.

‍

• Purposes of the Processing

‍

The Processing of Personal Data carried out by NABLA on behalf of the CLIENT is intended to provide the services specified in the Contract, in particular the automated generation of medical reports and the secure and technical availability of the Solution.

‍

• Legal Basis

‍

It is the responsibility of the DATA CONTROLLER to determine the appropriate legal basis for carrying out the Processing(s). In this regard, the DATA CONTROLLER may rely on one of the following grounds:

• The Processing is necessary for compliance with a legal obligation to which the data controller is subject (Article 6(1)(c) of the GDPR); or
• The Processing is necessary in order to protect the vital interests of the data subject (Article 6(1)(d) of the GDPR); or
• The Processing is necessary for the purposes of the legitimate interests pursued by the data controller (Article 6(1)(f) of the GDPR).

‍

In addition, the Processing of health data is permissible where the data controller may rely on Articles 9(2)(h) and 9(3) of the GDPR.

• Data Retention Periods

‍

Patient data is retained by default for 14 days, unless the Parties agree to a different retention period, or unless the CLIENT specifies a longer or shorter period in the Solution’s settings.

‍

Data relating to professional users (only applicable in cases of second-tier processing) are retained for the duration of the Contract, then archived or deleted according to CLIENT instructions, in compliance with applicable Regulation.

‍

• Transfer of Personal Data

‍

As a general rule, Personal Data is not processed or transferred outside of the European Union. However, in the event that Personal Data is transferred outside the EU, NABLA ensures that the third country offers an adequate level of protection as recognized by the European Commission under the GDPR. Where this is not the case, NABLA ensures that the transfer is conducted in accordance with the Standard Contractual Clauses (SCCs) adopted by the European Commission or Supervisory Authorities, including the CNIL in France, to guarantee data protection.

‍

• Technical and Organizational Measures to Ensure Data Security

The technical and organizational measures implemented by NABLA are described at the following URLs: https://www.nabla.com/fr/security and https://trust.nabla.com/. 

‍

APPENDIX 3 – PROCEDURE FOR EXERCISING DATA SUBJECT RIGHTS

‍

In accordance with Chapter III of the GDPR, the CLIENT must facilitate the exercise of the rights granted to data subjects.

‍

To this end, the CLIENT shall communicate to the data subjects the procedures by which they may submit a request to access their Personal Data or to exercise their rights to rectification, erasure, restriction of processing, data portability, or objection.

‍

The CLIENT may request assistance from NABLA in responding to data subject rights requests. In this context, it is hereby agreed between the Parties that the CLIENT guarantees it has properly verified the identity of the requester to ensure that the individual is lawfully entitled to access the Personal Data or exercise the requested right.

‍

Once the CLIENT has verified the requester’s identity and confirmed that the individual is the account holder, the CLIENT shall, where applicable, forward the request to NABLA at the following address: dpo@nabla.com.

‍

NABLA shall review the rights request and respond without undue delay, and in any case within a maximum period of one (1) month from receipt of the request.

‍

If necessary, this period may be extended by two (2) additional months, taking into account the complexity and number of requests. NABLA shall inform the data subject or the CLIENT—at the CLIENT’s discretion—of such extension and the reasons for the delay within one (1) month of receiving the request.

‍

If NABLA does not take action in response to a request from a data subject, it shall inform the individual or the CLIENT—again, at the CLIENT’s discretion—without undue delay and at the latest within one (1) month from receipt of the request (or within three (3) months in the event of an extension), of the reasons for not taking action and the possibility of lodging a complaint with a Supervisory Authority and seeking judicial remedy.

‍

NABLA shall inform the CLIENT of the response provided to the data subject, upon the CLIENT’s request.

‍

No fee shall be charged for responding to data subject requests. However, where requests from a data subject are manifestly unfounded or excessive, particularly because of their repetitive nature, NABLA may:

• Require the CLIENT to pay reasonable fees that reflect the administrative costs of providing the information or taking the requested action; or
• Refuse to act on the request.

‍

Appendix C – Statement of Work

‍

Description of the Services

‍

Nabla (Chrome extension, web and mobile app) is an ambient AI product that decreases time spent by care teams on clinical documentation and increases the quality of patient-clinician relationships.

‍

The goal of the pilot is to test out Nabla with a pool of your clinicians, adapt the tool for your

needs, measure the impact, and decide on a larger deployment.

‍

Timeline of the pilot

‍

Length of Pilot: 8 weeks

Estimated start Date: 06/02/2025

Number of clinicians: 10

Pricing: $0

‍

License and use

‍

During the length of the pilot, Nabla grants you a temporary, non-exclusive, personal, non-transferable right to use Nabla. This temporary right to use is ruled by the GTC (including DPA).

‍